For AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.

How to do it

Start from the smallest image of the system, such as a minimal cloud image. Remove compilers, mail servers, file sharing and admin tools the service does not use. Removing beats disabling, because a disabled service can be turned on again by mistake or by an attacker. Keep the list of expected listening ports in code, next to the host firewall rules. The same idea keeps build tools out of container images, as Keep build tools out of the runtime image says.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

Shell example

# Expected listening ports for this server, from the server's code. Prints every unexpected one.
EXPECTED="22 80 443"
ss -Htuln | awk '{ n = split($5, a, ":"); print a[n] }' | sort -un | while read -r port; do
  case " $EXPECTED " in *" $port "*) ;; *) echo "unexpected port $port" ;; esac
done

Shell example 2

apt-get purge --auto-remove -y postfix rpcbind cups avahi-daemon   # Debian and Ubuntu
dnf remove -y postfix rpcbind cups avahi                           # Red Hat family
systemctl list-unit-files --state=enabled --type=service           # compare with the server's list

How to check

The script below prints nothing on any server. It compares the listening ports with the expected list kept in code.

Sources

• NIST SP 800-123 Guide to General Server Security

Related rules

• Turn on a firewall on every host in Infrastructure
• Keep build tools out of the runtime image in Operations